MuckRock News 

DEPT MR 75726 

411A Highland Ave 

Somerville, MA 02144-2516 

75726-93446130(a)requests.muckrock.com 


Jefferson County Sheriff 
ORA Office 
6th Floor 
531 Court Place 
Louisville, KY 40202 


June 24, 2019 


To Whom It May Concern; 

Pursuant to the Kentucky Open Records Act, I hereby request the following records: 

Records mentioning, describing or generated as a result of the 8 May 2015 Roll Call Release IA-0181-15 
(which was designed to be shared widely with law enforcement) from the Department of Homeland 
Security's Office of intelligence and Analysis (I&A) in conjunction with the Federal Bureau of Investigation, 
titled "Criminal Hackers Target Police to Protest Perceived Injustices," as well as records otherwise 
responding or reacting to the issues raised in it. 

I am a member of the news media and request classification as such. I have previously written about the 
government and its activities, with some reaching over 100,000 readers in outlets such as Gizmodo, 
MuckRock, Motherboard, Property of the People, Unicorn Riot, and The Outline, among others. As such, as 
I have a reasonable expectation of publication and my editorial and writing skills are well established. In 
addition, I discuss and comment on the files online and make them available through non-profits such as 
the library Internet Archive and the journalist non-profit MuckRock, disseminating them to a large 
audience. While my research is not limited to this, a great deal of it, including this, focuses on the activities 
and attitudes of the government itself. 

As my primary purpose is to inform about government activities by reporting on it and making the raw data 
available, I request that fees be waived. 

The requested documents will be made available to the general public, and this request is not being made 
for commercial purposes. 

In the event that there are fees, I would be grateful if you would inform me of the total charges in advance 
of fulfilling my request. I would prefer the request filled electronically, by e-mail attachment if available or 
CD-ROM if not. 

Thank you in advance for your anticipated cooperation in this matter. I look forward to receiving your 
response to this request within 3 business days, as the statute requires. 

Sincerely, 
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MuckRock News 

DEPT MR 75726 

411A Highland Ave 

Somerville, MA 02144-2516 

75726-93446130@requests.muckrock.com 


Emma Best 


Filed via MuckRock.com 

E-mail (Preferred): 75726-93446130@requests.muckrock.com 

For mailed responses, please address (see note): 

MuckRock News 
DEPT MR 75726 
411A Highland Ave 
Somerville, MA 02144-2516 

PLEASE NOTE: This request is not filed by a MuckRock staff member, but is being sent through MuckRock 
by the above in order to better track, share, and manage public records requests. Also note that improperly 
addressed (i.e., with the requester's name rather than "MuckRock News" and the department number) 
requests might be returned as undeliverable. 
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UNCLASSIFIED//FOR OFFICIAL USE ONLY 


ROLL CALL RELEASE 

INTELLIGENCE FOR POLICE, FIRE. EMS. AND SECURITY PERSONNEL ^ 


8 May 2015 


(U//FOUO) Cnminal Hackers Target Police to Protest Perceived Injustices 

(U//FOUO) Disruptive cyber attacks by criminal hackers—primarily 
distributed-denial-of-service (DDoS) attacks—targeting local law enforcement 
websites have increased since August 2014. We judge that this is almost 
certainly a result of the heightened coverage surrounding the alleged use of 
excessive force by law enforcement and an increased focus on incidents of 
perceived police brutality. The primary impact from the majority of these 
attacks has been the temporary disruption of the targeted public-facing websites. 

» (U//FOUO) In 2014, the Multi-State Information Sharing and Analysis 
Center (MS-ISAC) observed 53 separate incidents of criminal hackers 
conducting cyber operations against state and local entities in response to 
incidents of alleged use of excessive force by law enforcement. The majority of these incidents were low to 
moderate in effect, most frequently resulting in temporary disruption to targeted websites. 



» (U//FOUO) On the morning of 30 December 2014, unknown criminal hackers disabled a Midwestern police 
department’s public website using a DDoS attack. A post later that morning on a US social-networking site 
containing the hashtag “#BlackLives Matter” announced that the targeted website was down. The disabling 
of this website was the third successful attack to disable a law enforcement website in the state within a week— 
the attacks were limited to the temporary disablement of targeted websites, according to DHS field reporting. 

» (U//FOUO) A criminal hacker using the moniker (at)DigltaShadow claimed responsibility on a US social-media site 
for disrupting access to a Northwestern city police department’s website in early December 2014. The DDoS 
attack, which lasted approximately 10 minutes, prevented the department’s in-car terminals from transmitting or 
receiving traffic, including 91 I dispatch requests, according to FBI reporting. 

(U//FOUO) MS-ISAC Di$tributed-Denial-of-Service Mitigation Recommendations 

(U) Proactive protections include: 

» (U) Establish connections with multiple Internet service providers (ISPs) for redundancy, 

» (U) Ensure service-level agreements with ISPs contain provisions for DoS prevention (such as IP address rotation), 

» (U) Conduct rate-limiting of traffic at the network perimeter, and 

» (U) Create backup, remote-site network infrastructure using multiple addressing schemes. 

(U) Reactive protections include: 

» (U) Execute ISP address rotation, 

» (U) Block source IP addresses generating DoS traffic at enterprise boundary or within ISP infrastructure, and 

» (U) Acquire increased bandwidth capability from the ISP. 

(U//FOUO) See MS-ISAC*s “Guide to DDoS Attacks” for additional information: 

http://msisac.cisecurity.org/resources/reports/ documents/GuidetoDDoSAttacks_OOO.pdf. 


(U) Reporting Computer Security Incidents 


(U) To report a computer security incident, either contact US-CERT at 888-282-0870, or go to https;//forms.us-cert.gov/report/ and 
complete the US-CERT Incident Reporting System form. The US-CERT Incident Reporting System provides a secure, web-enabled means of 
reporting computer security incidents to US-CERT. An incident is defined as a violation or imminent threat of violation of computer security policies, 
acceptable use policies, or standard computer security praaices. In general, types of aalvity commonly recognized as violating typical security policies 
include attempts (either foiled or successful) to gain unauthorized access to a system or its data, including personally identifiable information; unwanted 
disruption or denial of service; the unauthorized use of a system for processing or storing data; and changes to system hardware, firmware, or software 
without the owner’s knowledge, instruction, or consent 

IA-0I8I-I5 


Prepared by the Office of mteSgence and Analysts (l&A) Coordnoted with the FBI This produa is intended to prowde cybersecunty awareness to federal, state heal, and pnwjte sector first responders in matters that 
can affect personnel and nefwork security of their respective organizations. 

(U} Warning: Ths document is UNCLASSIfl£D//F0R OFFICIAL USE ONLY (U//F0U0) It contains information that may be exempt from ptibSc release under the Freedom of Information Act (5 U.S.C 552). It is to be 
controKed. stored, hanrSed, transmitted, distributed, and disposed of in accordance with DHS poky relating to FOUO information and is not to be released to the pubbe, the media, or other personnel who do not hove a vabd 
need to know without prior approval of an authorized DHS offkial State and heal homeland secuiity offioak may share this document with authorized cntical irifrastruaure and key resource personnel and pnvate sector 
security offends without further approval from DHS. 
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